Description
The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.
Affected products
uutils: coreutils
References3
- github.com/uutils/coreutils/pull/10582 ExploitIssue TrackingPatch
- github.com/uutils/coreutils/pull/10582 ExploitIssue TrackingPatch
- github.com/uutils/coreutils/releases/tag/0.6.0 Release Notes
Metrics
- CVSS 3.1
-
4.4
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 4 · as of 13 November 2026
- CWE
- CWE-281CWE-459
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.